code-projects Pharmacy Management System Parameter index.php editManager sql injection

Vulnerability

A critical SQL injection vulnerability has been identified in code-projects Pharmacy Management System version 1.0. The issue resides in the editManager function within /index.php?action=editManager. The id parameter, passed as part of a string, is not properly sanitized before being used in a SQL query, allowing an attacker to manipulate the query structure [1]. The product uses continuous delivery with rolling releases, so specific version details for affected or updated releases are not available.

Exploitation

An attacker can exploit this vulnerability remotely without requiring authentication. By sending a crafted HTTP request to the vulnerable endpoint with a malicious SQL payload in the id parameter, the attacker can inject arbitrary SQL commands. The exploit has been publicly disclosed, increasing the risk of widespread use [1].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL queries against the backend database. This could lead to unauthorized access to sensitive data, including user credentials, patient records, or other stored information. The attacker may also be able to modify or delete data, potentially compromising the integrity and availability of the application.

Mitigation

As of the publication date, no official patch or updated version has been released by the vendor. The product uses rolling releases, but no fixed version details are available. Given that the exploit is publicly known, users are advised to implement input validation and parameterized queries as a workaround, or consider discontinuing use of the vulnerable component until a fix is provided [1].